# Forgejo Actions CI: existing Docker runner

The only registered Forgejo runner has the **docker** label. Workflow:
.forgejo/workflows/ci.yml. It uses runs-on: docker with the official
swift:6.2-noble Linux container image.

## CI checks

- Main branch / manual dispatch: obtain the exact triggering commit, validate
  source and shell scripts, and run the **real** XCTest suite for the pure
  Swift CapswitchCore module.
- Tags v*: same tests plus Info.plist-version/tag consistency checking.
  The v0.3.0 tag must match CFBundleShortVersionString 0.3.0.

scripts/test-linux-core.sh creates a temporary SwiftPM package containing
the actual Sources/Capswitch source files and Tests/CapswitchCoreTests suite.
The standard Package.swift is macOS-specific and cannot be compiled on Linux.

## Why Docker CI does not produce a macOS binary

Linux Docker does not include the Apple macOS SDK, AppKit, Carbon or IOKit.
It cannot generate a signed functional macoc.app. This workflow does not run
scripts/package.sh on Linux and does not create a misleading binary release.

For a release with the current infrastructure:

1. Push tag v0.3.0 (or the version in Info.plist); verify Docker CI passed.
2. On a real Mac with Command Line Tools, check out that precise tag.
3. Run bash scripts/package.sh (equivalent to task package). This creates
   dist/macoc-v0.3.0-macos-<arch>.zip and the SHA-256 checksum file.
4. Set FORGEJO_SERVER_URL, FORGEJO_REPOSITORY=catsona/macoc,
   FORGEJO_REF_NAME=v0.3.0, and FORGEJO_TOKEN with repository release write
   access; then run bash scripts/publish-release.sh to publish the Mac
   generated ZIP/checksum to Forgejo.

That is a manual macOS packaging step. For fully automated builds of
macOS binaries, a real Mac runner or a trusted Mac build service is needed.

Code signing / Developer ID notarization is separate; ad-hoc builds may
require explicit Gatekeeper approval.

## No Node checkout dependency

Forgejo Runner's default Docker image might supply Node, but the official
Swift image does not promise Node.js, so actions/checkout is not used.
The workflow obtains an authenticated archive at the triggering SHA using
Forgejo's own API, with the short-lived repository-scoped forgejo.token.
The token is only placed in a mode-0600 temporary curl configuration,
not in clone URLs, source files or process arguments.

As tar archives have no Git index, the job creates a local Git index for
git diff --cached --check. No CI commit or push occurs.

## Prerequisites

The registered runner must advertise the docker label to this repository.
It must be allowed to pull swift:6.2-noble from Docker Hub and reach the
Forgejo API. No Docker socket inside the job is necessary.

Forgejo documentation:
https://forgejo.org/docs/latest/admin/actions/configuration/
https://forgejo.org/docs/latest/user/actions/reference/
https://forgejo.org/docs/latest/user/actions/security/

Swift Docker:
https://www.swift.org/install/linux/docker/